Anomalous sound detection with timbre separation

ABSTRACT

Methods, systems, and computer program products for detecting anomalous behavior include reconstructing a waveform of a target device from an input waveform using a target autoencoder. A waveform of unrelated sound events is reconstructed from the input waveform using an environmental autoencoder. The input waveform is classified to determine that the input waveform is produced by anomalous behavior of the target device using a classifier, based on the reconstructed waveform of the target device and the reconstructed waveform of the unrelated sound events. An automatic response to the anomalous behavior is generated.

BACKGROUND

The present invention generally relates to anomalous sound detection,and, more particularly, to the separation of relevant anomalous soundsfrom irrelevant anomalous sounds.

Acoustic information may be used as an indicator of a machine'scondition. While visual information may be helpful, such inspection isoften only possible at the surface level. In contrast, an acousticsignal from the machine can provide insights about the machine's innerworkings.

Anomaly detection may be performed using an unsupervised machinelearning task, where a training dataset is provided to show the expectedwaveforms of normal operation. However, such a model may treat allanomalies or outliers the same, with little ability to distinguishbetween different types of anomalies.

SUMMARY

A computer program product for detecting anomalous behavior, thecomputer program product comprising a computer readable storage mediumhaving program instructions embodied therewith. The program instructionsare executable by a hardware processor to cause the hardware processorto reconstruct a waveform of a target device from an input waveformusing a target autoencoder. A waveform of unrelated sound events isreconstructed from the input waveform using an environmentalautoencoder. The input waveform is classified to determine that theinput waveform is produced by anomalous behavior of the target deviceusing a classifier, based on the reconstructed waveform of the targetdevice and the reconstructed waveform of the unrelated sound events. Anautomatic response to the anomalous behavior.

A method for training an anomalous behavior classifier includes traininga target autoencoder, using training data that represents normaloperation of a target device, to generate a reconstructed target devicewaveform from a mixed input waveform. A first environmental autoencoderis trained, using training data that represents a first set of unrelatedsound events, to generate a reconstructed unrelated waveform from amixed input waveform. A neural network classifier is trained, usingreconstructed target device waveforms and unrelated waveforms based onthe training data, to generate an output that classifies whether aninput waveform represents anomalous behavior of the target device.

A system for detecting anomalous behavior that includes a hardwareprocessor and a memory. The memory stores computer program instructions,that are executable by the hardware processor to cause the hardwareprocessor to reconstruct a waveform of a target device from an inputwaveform using a target autoencoder, to reconstruct a waveform ofunrelated sound events from the input waveform using an environmentalautoencoder, to classify the input waveform to determine that the inputwaveform is produced by anomalous behavior of the target device using aclassifier, based on the reconstructed waveform of the target device andthe reconstructed waveform of the unrelated sound events, and togenerate an automatic response to the anomalous behavior.

These and other features and advantages will become apparent from thefollowing detailed description of illustrative embodiments thereof,which is to be read in connection with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The following description will provide details of preferred embodimentswith reference to the following figures wherein:

FIG. 1 is a diagram that shows a machine that is being monitored forabnormal behavior, in an environment with unrelated sounds, inaccordance with an embodiment of the present invention;

FIG. 2 is a block diagram that illustrates the structure of a neuralnetwork that classifies waveforms according to whether they representabnormal behavior in a machine, in accordance with an embodiment of thepresent invention;

FIG. 3 is a block/flow diagram of a method for detecting and correctingabnormal behavior in a machine according to a detected waveform, in anenvironment with unrelated sounds, in accordance with an embodiment ofthe present invention;

FIG. 4 is a block diagram of an anomaly detection and response systemthat detects and corrects abnormal behavior in a machine according to adetected waveform, in an environment with unrelated sounds, inaccordance with an embodiment of the present invention;

FIG. 5 is a diagram that illustrates a neural network architecture thatmay be used to implement one or more parts of a neural network model, inaccordance with an embodiment of the present invention; and

FIG. 6 is a diagram of a cloud computing environment according to thepresent principles; and

FIG. 7 is a diagram of abstraction model layers according to the presentprinciples.

DETAILED DESCRIPTION

A target waveform may be emphasized among noise by using two types ofautoencoders, including a target autoencoder and an environmentalautoencoder. For example, if acoustic waveforms are being collected tomonitor a particular machine, then the sounds of that machine mayrepresent the target waveform, and background events may represent thenoise. Whereas the target autoencoder may be trained on waveform signalsthat are related to normal operation of the machine, the environmentalautoencoder may be trained on samples that include other signals, forexample signals that are selectively chosen using knowledge of theenvironment and the types of sounds that may occur.

The reconstructed signals, generated by the respective autoencoders, maybe used as auxiliary features that are combined with the original inputsignal, for example by concatenating the reconstructed signals with theoriginal input signal. The combined feature signal may then be used totrain a classifier or other machine learning model, for example togenerate a final anomaly score that represents a likelihood that aparticular input waveform indicates a relevant anomaly at the machine.

Referring now to the drawings in which like numerals represent the sameor similar elements and initially to FIG. 1, an exemplary acousticenvironment is shown. The environment includes a machine 102, whichgenerates sounds as part of its operation. These sounds may representnormal operation, where the machine 102 is operating within expectedparameters, and may also represent abnormal operation, where the machine102 is malfunctioning or is operating in some unexpected way.

Also present in the environment are various unrelated sound events 106.These unrelated sound events 106 may come from any source, includinghuman operators, other machinery, closing doors, dropped objects, andany other occurrence, whether predictable or unpredictable. For example,in an environment that includes a workshop, such unrelated sound events106 may include the sounds of a hammer, a saw, a fan, a drill, or anyother type of expected activity or event that could reasonably beexpected to occur in a workshop.

The sounds in the environment may be measured by one or more audiosensors 104, such as a microphone that measures pressure waves in air.The recorded sound information, for example represented as audiowaveforms, may be used to identify whether the machine 102 is operatingnormally or abnormally. A set of training data may be created thatincludes a variety of waveforms, including sounds that represent thenormal operation of the machine 102, as well as sounds that representknown types of unrelated sound events 106 that might be found in theenvironment. The waveform that is recorded at the audio sensor 104 maytherefore include multiple different signals, overlapping in a singletime series.

It should be understood that, although audio signals are specificallycontemplated, other forms of inputs may be included. For example, radiosignals may similarly be measured at an antenna, with signals from asource of interest may mix with signals from unrelated events. Othertypes of signals that may be used include, but are not limited to,pressure waves in media other than air, such as in water or in theearth.

A classifier may be used to make determinations about the operation ofthe machine 102. Such a classifier may be trained using the trainingdata described above. Such a classifier may be trained using both theinformation that represents normal operation of the machine 102, as wellas information that represents the unrelated sound events 106.

Referring now to FIG. 2, a diagram shows a classification task thatincludes a target autoencoder and an environmental autoencoder. Whileonly these two autoencoders are shown, others may be included inparallel, using different architectures to generate auxiliary signals.An input signal waveform 200 includes a target waveform 201 and anunrelated waveform 202. These two waveforms are shown as overlapping,when in an actual measured waveform, they would interfere with oneanother, adding their respective amplitudes.

The input waveform 200 is introduced as input to a target autoencoder204 and to an environmental autoencoder 206. The input waveform 200 maybe input in its raw form, or converted into spectrogram features, inaccordance with the autoencoder architecture. Autoencoder networks mayinclude two sections: an encoder section and a decoder section. Theencoder section may create a relatively low-dimensional embedding of arelatively high-dimensional input, while the decoder section mayrecreate the original high-dimensional input. The autoencoder network istrained to recreate the original input as closely as possible. Suchnetworks may be used in various ways. For example, the low-dimensionalembedding may be used as a relatively compact representation of theoriginal input. The high-dimensional output, meanwhile, may be used toreconstruct information from a noisy input. Although autoencoder neuralnetworks are specifically contemplated, it should be understood that anyappropriate architecture may be used instead. These autoencoders mayhave any appropriate neural network architecture. In one specific andnon-limiting example, each autoencoder may include a set of fullyconnected layers using a rectified linear unit (ReLU) activationfunction.

Each neuron in neural network may have a respective activation function.These activation functions represent an operation that is performed onthe input of the neuron, and that help to generate the output of theneuron. Exemplary activation functions include the logistic function,the hyperbolic tangent, ReLU, softmax, and maxout, but any appropriateactivation function may be used.

In particular, a ReLU activation function may be used. ReLU provides anoutput that is zero when the input is negative, and reproduces the inputwhen the input is positive. The ReLU function notably is notdifferentiable at zero—to account for this during training, theundefined derivative at zero may be replaced with a value of zero orone.

Each autoencoder may be trained on a respective set of signals. Forexample, the target autoencoder 204 may be trained using trainingwaveforms that represent normal operation of the machine 102, while theenvironmental autoencoder 206 may be trained using training waveformsthat represent unrelated sound events 106 that are expected to occurwithin the environment. In some cases, the environmental autoencoder 206may be trained using any signals other than the target signal, ratherthan solely those that are expected to occur within a specificenvironment. The output of each autoencoder is an approximatereconstruction of the respective part of the original input waveform200. Thus, the target autoencoder 204 may output a reconstruction 208 ofthe target waveform 201, while the environmental autoencoder 206 mayoutput a reconstruction 210 of the unrelated waveform 202.

The original waveform 200 may be combined with the reconstructed targetwaveform 208 and the reconstructed unrelated waveform 210 at combiner212. The combiner 212 may perform any appropriate combination of thedifferent signals, but it is specifically contemplated that aconcatenation operation may be performed. Any combination of signalsfrom the autoencoders may be used, depending on the problem setting anddataset characteristics. If additional environmental autoencoders areused, they may be selectively combined to reflect differentenvironmental conditions.

A classifier 214 accepts the combined waveform as an input, andgenerates a classification score. For example, the classifier 214 mayoutput a maximum softmax probability that represents a degree ofconfidence that the input waveform 200 represents anomalous behavior ofthe machine 102. For example, a score may be expressed as:

score(x)=1−y ^(j)(feat(x))

where y is a convolutional neural network (CNN) model, j is an indexthat relates to one of multiple different machine types that the modelmay be trained to handle, and feat(x) is a combined feature vector fromthe autoencoder outputs and the original signal waveform.

CNNs process information using a sliding “window” across an input, witheach neuron in a CNN layer having a respective “filter” that is appliedat each window position. Each filter may be trained, for example, tohandle a respective pattern within an input. Local relationships betweendifferent parts of the input may be captured by the filter as it passesthrough different regions of the data. The output of a neuron in a CNNlayer may include a set of values, representing whether the respectivefilter matched each set of values in the sliding window.

In one specific and non-limiting example, the classifier 214 may includea set of CNN layers, each with batch normalization and a rectifiedlinear unit activation function. The output of the last CNN layer mayfeed to a global max pooling layer with dropout regularization. A set offully connected layers lead to a softmax output. The classifier's outputmay include classification results for each machine type and machineidentifier that can be detected.

This neural network model may be implemented on-site, or may beperformed in a distributed fashion, with different environmentalautoencoders being trained for different respective conditions. It is tobe understood in advance that, although this disclosure includes adetailed description of cloud computing, implementation of the teachingsrecited herein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Referring now to FIG. 3, a method of training and using a classifier forabnormal sound information is shown. Block 302 trains the targetautoencoder 204 and block 304 trains the environmental autoencoder 206using different training datasets. These training steps may be performedusing predetermined waveforms that are known to represent soundsassociated with normal operation of a machine 102 and that are known torepresent expected unrelated sound events 106, respectively. Therespective autoencoders are trained to reproduce the input trainingwaveforms.

The autoencoders 204 and 206 may be trained using a mean squared errorloss, where the reconstructed signal is compared to the trainingwaveform. For example, a loss function for the target autoencoder 204may be expressed as:

$L_{target} = {\sum\limits_{n = 1}^{N}{{x_{target}^{n} - {D_{target}\left( {E_{target}\left( x_{target}^{n} \right)} \right)}}}_{2}^{2}}$

where x_(target) ^(n) is the n^(th) segment of the target trainingwaveform x, with dimensions (bin, frame), N is the number of segments inthe target training waveform, D_(target) is the operation of the decoderof the target autoencoder 204, and E_(target) is the operation of theencoder of the target autoencoder 204. A loss function for theenvironmental autoencoder 206 may be expressed as:

$L_{env} = {\sum\limits_{n = 1}^{N}{{x_{env}^{n} - {D_{env}\left( {E_{env}\left( x_{env}^{n} \right)} \right)}}}_{2}^{2}}$

where x_(env) ^(n) is n^(th) segment of the environmental trainingwaveform x, with dimensions (bin, frame), N is the number of segments inthe environmental training waveform, D_(env) is the operation of thedecoder of the environmental autoencoder 206, and E_(env) is theoperation of the encoder of the environmental autoencoder 206.

Segments of the reconstructed signals may be concatenated to form atotal reconstructed signal:

Aux_(env)(x)=concat(D _(env)(E _(env)(x ¹)), . . . , D _(env)(E _(env)(x^(N))))

Aux_(tar)(x)=concat(D _(target)(E _(target)(x ¹)), . . . , D _(target)(E_(target)(x ^(N))))

where Aux_(env)(x) is the auxiliary signal generated by theenvironmental autoencoder and Aux_(tar)(x) is the auxiliary signalgenerated by the target autoencoder.

These “auxiliary” signals may be provided, along with the raw signal, toform various combinations of signals as input features feat(x) to afeature-learning-based classifier, for example by concatenating theselected raw and auxiliary signals in the channel dimension:

feat(x)=concat(x, Aux_(env)(x), Aux_(tar)(x))

Block 306 then trains the classifier 214 using signals that representnormal operation. During training of the classifier 214, theautoencoders may be fixed. The classifier model 214 may be trained byoptimizing a cross-entropy loss, which classifies the machine types, aswell as specific machine identifiers, of a given input waveform x.

The training dataset may include sound clips of particular sounds, suchas sounds associated with normal operation of the machine 102 and withknown unrelated sound events 106. These sound clips may be mixed withbackground environmental sounds from an environment that matches theenvironment in question, such as a workshop or factory. In some cases,pure-machine sound clips and unrelated sound event clips may be providedseparately, while some datasets may provide combined sound clips.

Block 308 collects new waveform data, for example using the microphone104 in the environment. As noted above, the new waveform data mayinclude a variety of different waveforms, including sounds that indicatenormal operation of the machine 102, abnormal operation of the machine,and unrelated sound events 106. This new waveform data characterizes thepresent state of the environment.

Block 310 then classifies the new waveform data using the autoencoders204 and 206 and the classifier 214, as described above. The classifier214 generates an output that represents a likelihood that the newwaveform data represents an abnormality in the machine 102. Theclassifier 214 may classify according to multiple different classes,corresponding to different machine identifiers. These identifiers maycorrespond to different types of machine, or may correspond to specificmachines. The output of the classifier 214 may therefore be a confidencevalue for each of these identifiers. This confidence value may indicatehow likely the machine 102 is to be operating normally. The likelihoodthat the machine 102 is operating abnormally can be determined bysubtracting the confidence score from 1.

Using this information, block 312 can perform a corrective action, forexample if abnormal operation is indicated. The corrective action caninclude any appropriate response to an abnormal condition. For example,block 312 may alert a human operator to investigate and correct theabnormality. Block 312 may automatically respond to the abnormality, forexample by automatically changing settings on the machine 102, bychanging qualities of the environment (e.g., heating/cooling, humidity,lighting), or turning off the machine 102 or other nearby equipment.

The present invention may be a system, a method, and/or a computerprogram product at any possible technical detail level of integration.The computer program product may include a computer readable storagemedium (or media) having computer readable program instructions thereonfor causing a processor to carry out aspects of the present invention.

The computer readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, configuration data for integrated circuitry, oreither source code or object code written in any combination of one ormore programming languages, including an object oriented programminglanguage such as Smalltalk, C++, or the like, and procedural programminglanguages, such as the “C” programming language or similar programminglanguages. The computer readable program instructions may executeentirely on the user's computer, partly on the user's computer, as astand-alone software package, partly on the user's computer and partlyon a remote computer or entirely on the remote computer or server. Inthe latter scenario, the remote computer may be connected to the user'scomputer through any type of network, including a local area network(LAN) or a wide area network (WAN), or the connection may be made to anexternal computer (for example, through the Internet using an InternetService Provider). In some embodiments, electronic circuitry including,for example, programmable logic circuitry, field-programmable gatearrays (FPGA), or programmable logic arrays (PLA) may execute thecomputer readable program instructions by utilizing state information ofthe computer readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a computer, or other programmable data processing apparatusto produce a machine, such that the instructions, which execute via theprocessor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks. These computerreadable program instructions may also be stored in a computer readablestorage medium that can direct a computer, a programmable dataprocessing apparatus, and/or other devices to function in a particularmanner, such that the computer readable storage medium havinginstructions stored therein comprises an article of manufactureincluding instructions which implement aspects of the function/actspecified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

As employed herein, the term “hardware processor subsystem” or “hardwareprocessor” can refer to a processor, memory, software or combinationsthereof that cooperate to perform one or more specific tasks. In usefulembodiments, the hardware processor subsystem can include one or moredata processing elements (e.g., logic circuits, processing circuits,instruction execution devices, etc.). The one or more data processingelements can be included in a central processing unit, a graphicsprocessing unit, and/or a separate processor- or computing element-basedcontroller (e.g., logic gates, etc.). The hardware processor subsystemcan include one or more on-board memories (e.g., caches, dedicatedmemory arrays, read only memory, etc.). In some embodiments, thehardware processor subsystem can include one or more memories that canbe on or off board or that can be dedicated for use by the hardwareprocessor subsystem (e.g., ROM, RAM, basic input/output system (BIOS),etc.).

In some embodiments, the hardware processor subsystem can include andexecute one or more software elements. The one or more software elementscan include an operating system and/or one or more applications and/orspecific code to achieve a specified result.

In other embodiments, the hardware processor subsystem can includededicated, specialized circuitry that performs one or more electronicprocessing functions to achieve a specified result. Such circuitry caninclude one or more application-specific integrated circuits (ASICs),FPGAs, and/or PLAs.

These and other variations of a hardware processor subsystem are alsocontemplated in accordance with embodiments of the present invention.

Referring now to FIG. 4, an anomaly detection and response system 400 isshown. The system 400 includes a hardware processor 402 and a memory404. A sensor interface 406 may receive information from the sensor(s)104 by any appropriate wired or wireless communications medium andprotocol. A network interface 407 may communicate with one or moredevices in the environment, for example including one or more machines102 and environmental controls. The sensor interface 406 may use thenetwork interface 407, or may include one or more dedicated sensorinputs.

A model trainer 410 may train an anomaly detection model 412, forexample using a set of training data 408 that may be stored in memory404. In some cases, the anomaly detection model 412 may be trained inadvance, such that the training data 408 and the model trainer 410 neednot be implemented in the system 400.

As new waveform information is received by the sensor interface 406, theanomaly detection model 412 determines whether it represents anomalousor abnormal behavior. An auto-responder 414 automatically responds toabnormal behavior, for example by issuing commands to one or moredevices in the environment using network interface 407.

As noted above, the anomaly detection model 412 may be implemented as anartificial neural network (ANN). An ANN is an information processingsystem that is inspired by biological nervous systems, such as thebrain. One element of ANNs is the structure of the informationprocessing system, which includes a large number of highlyinterconnected processing elements (called “neurons”) working inparallel to solve specific problems. ANNs are furthermore trained usinga set of training data, with learning that involves adjustments toweights that exist between the neurons. An ANN is configured for aspecific application, such as pattern recognition or dataclassification, through such a learning process.

Referring now to FIG. 5, a generalized diagram of a neural network isshown. Although a specific structure of an ANN is shown, having threelayers and a set number of fully connected neurons, it should beunderstood that this is intended solely for the purpose of illustration.In practice, the present embodiments may take any appropriate form,including any number of layers and any pattern or patterns ofconnections therebetween.

ANNs demonstrate an ability to derive meaning from complicated orimprecise data and can be used to extract patterns and detect trendsthat are too complex to be detected by humans or other computer-basedsystems. The structure of a neural network is known generally to haveinput neurons 502 that provide information to one or more “hidden”neurons 504. Connections 508 between the input neurons 502 and hiddenneurons 504 are weighted, and these weighted inputs are then processedby the hidden neurons 504 according to some function in the hiddenneurons 504. There can be any number of layers of hidden neurons 504,and as well as neurons that perform different functions. There existdifferent neural network structures as well, such as a convolutionalneural network, a maxout network, etc., which may vary according to thestructure and function of the hidden layers, as well as the pattern ofweights between the layers. The individual layers may perform particularfunctions, and may include convolutional layers, pooling layers, fullyconnected layers, softmax layers, or any other appropriate type ofneural network layer. Finally, a set of output neurons 506 accepts andprocesses weighted input from the last set of hidden neurons 504.

This represents a “feed-forward” computation, where informationpropagates from input neurons 502 to the output neurons 506. Uponcompletion of a feed-forward computation, the output is compared to adesired output available from training data. The error relative to thetraining data is then processed in “backpropagation” computation, wherethe hidden neurons 504 and input neurons 502 receive informationregarding the error propagating backward from the output neurons 506.Once the backward error propagation has been completed, weight updatesare performed, with the weighted connections 508 being updated toaccount for the received error. It should be noted that the three modesof operation, feed forward, back propagation, and weight update, do notoverlap with one another. This represents just one variety of ANNcomputation, and that any appropriate form of computation may be usedinstead.

To train an ANN, training data can be divided into a training set and atesting set. The training data includes pairs of an input and a knownoutput. During training, the inputs of the training set are fed into theANN using feed-forward propagation. After each input, the output of theANN is compared to the respective known output. Discrepancies betweenthe output of the ANN and the known output that is associated with thatparticular input are used to generate an error value, which may bebackpropagated through the ANN, after which the weight values of the ANNmay be updated. This process continues until the pairs in the trainingset are exhausted.

After the training has been completed, the ANN may be tested against thetesting set, to ensure that the training has not resulted inoverfitting. If the ANN can generalize to new inputs, beyond those whichit was already trained on, then it is ready for use. If the ANN does notaccurately reproduce the known outputs of the testing set, thenadditional training data may be needed, or hyperparameters of the ANNmay need to be adjusted.

ANNs may be implemented in software, hardware, or a combination of thetwo. For example, each weight 508 may be characterized as a weight valuethat is stored in a computer memory, and the activation function of eachneuron may be implemented by a computer processor. The weight value maystore any appropriate data value, such as a real number, a binary value,or a value selected from a fixed number of possibilities, that ismultiplied against the relevant neuron outputs. Alternatively, theweights 508 may be implemented as resistive processing units (RPUs),generating a predictable current output when an input voltage is appliedin accordance with a settable resistance.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g., networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported, providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based e-mail).The consumer does not manage or control the underlying cloudinfrastructure including network, servers, operating systems, storage,or even individual application capabilities, with the possible exceptionof limited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure that includes anetwork of interconnected nodes.

Referring now to FIG. 6, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 includes one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 7 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 7, a set of functional abstraction layers providedby cloud computing environment 50 (FIG. 6) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 7 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include: mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may include applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; and anomaly detection 96.

Reference in the specification to “one embodiment” or “an embodiment” ofthe present invention, as well as other variations thereof, means that aparticular feature, structure, characteristic, and so forth described inconnection with the embodiment is included in at least one embodiment ofthe present invention. Thus, the appearances of the phrase “in oneembodiment” or “in an embodiment”, as well any other variations,appearing in various places throughout the specification are notnecessarily all referring to the same embodiment.

It is to be appreciated that the use of any of the following “/”,“and/or”, and “at least one of”, for example, in the cases of “A/B”, “Aand/or B” and “at least one of A and B”, is intended to encompass theselection of the first listed option (A) only, or the selection of thesecond listed option (B) only, or the selection of both options (A andB). As a further example, in the cases of “A, B, and/or C” and “at leastone of A, B, and C”, such phrasing is intended to encompass theselection of the first listed option (A) only, or the selection of thesecond listed option (B) only, or the selection of the third listedoption (C) only, or the selection of the first and the second listedoptions (A and B) only, or the selection of the first and third listedoptions (A and C) only, or the selection of the second and third listedoptions (B and C) only, or the selection of all three options (A and Band C). This may be extended, as readily apparent by one of ordinaryskill in this and related arts, for as many items listed.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the blocks may occur out of theorder noted in the Figures. For example, two blocks shown in successionmay, in fact, be accomplished as one step, executed concurrently,substantially concurrently, in a partially or wholly temporallyoverlapping manner, or the blocks may sometimes be executed in thereverse order, depending upon the functionality involved. It will alsobe noted that each block of the block diagrams and/or flowchartillustration, and combinations of blocks in the block diagrams and/orflowchart illustration, can be implemented by special purposehardware-based systems that perform the specified functions or acts orcarry out combinations of special purpose hardware and computerinstructions.

Having described preferred embodiments of a system and method (which areintended to be illustrative and not limiting), it is noted thatmodifications and variations can be made by persons skilled in the artin light of the above teachings. It is therefore to be understood thatchanges may be made in the particular embodiments disclosed which arewithin the scope of the invention as outlined by the appended claims.Having thus described aspects of the invention, with the details andparticularity required by the patent laws, what is claimed and desiredprotected by Letters Patent is set forth in the appended claims.

What is claimed is:
 1. A computer program product for detectinganomalous behavior, the computer program product comprising a computerreadable storage medium having program instructions embodied therewith,the program instructions being executable by a hardware processor tocause the hardware processor to: reconstruct a waveform of a targetdevice from an input waveform using a target autoencoder; reconstruct awaveform of unrelated sound events from the input waveform using anenvironmental autoencoder; classify the input waveform to determine thatthe input waveform is produced by anomalous behavior of the targetdevice using a classifier, based on the reconstructed waveform of thetarget device and the reconstructed waveform of the unrelated soundevents; and generate an automatic response to the anomalous behavior. 2.The computer program product of claim 1, wherein the programinstructions further cause the hardware processor to concatenate acurrent reconstructed waveform of the target device, a currentreconstructed waveform of the unrelated sound events, and a currentoriginal waveform that is used to generate the current reconstructedwaveforms to form a concatenated signal.
 3. The computer program productof claim 2, wherein the classifier accepts the concatenated signal as aninput.
 4. The computer program product of claim 1, wherein the programinstructions further cause the hardware processor to generate the inputwaveform using input from a sensor device in an environment thatincludes the target device.
 5. The computer program product of claim 1,wherein the first environmental autoencoder is trained using samplewaveforms of multiple different sounds, unrelated to operation of thetarget device.
 6. The computer program product of claim 1, wherein theprogram instructions further cause the hardware processor to reconstructa second waveform of unrelated sound events from the input waveformusing at least one additional environmental autoencoder.
 7. The computerprogram product of claim 6, wherein the program instructions furthercause the hardware processor to combine a subset of the input waveform,the reconstructed waveform output of the target autoencoder, andreconstructed waveform outputs of the first environmental autoencoderand the at least one additional environmental autoencoder, to form acombined signal as input to the classifier.
 8. The computer programproduct of claim 1, wherein the automatic response includes an actionselected from the group consisting of changing settings on the targetdevice, changing qualities of the environment, and turning off thetarget device or other nearby equipment.
 9. A computer-implementedmethod for training an anomalous behavior classifier, comprising:training a target autoencoder, using training data that representsnormal operation of a target device, to generate a reconstructed targetdevice waveform from a mixed input waveform; training a firstenvironmental autoencoder, using training data that represents a firstset of unrelated sound events, to generate a reconstructed unrelatedwaveform from a mixed input waveform; and training a neural networkclassifier, using reconstructed target device waveforms and unrelatedwaveforms based on the training data, to generate an output thatclassifies whether an input waveform represents anomalous behavior ofthe target device.
 10. The method of claim 9, wherein training theneural network classifier includes concatenating a reconstructedtraining waveform from the target autoencoder, a reconstructedenvironmental waveform of the first environmental autoencoder, and anoriginal training waveform for use as a training input to theclassifier.
 11. The method of claim 9, wherein the first environmentalautoencoder is trained using sample waveforms of multiple differentsounds, unrelated to operation of the target device.
 12. The method ofclaim 9, further comprising training at least one additionalenvironmental autoencoder, using training data that representsrespective sets of unrelated sound events, to generate a reconstructedunrelated waveform from a mixed input waveform.
 13. A system fordetecting anomalous behavior, comprising: a hardware processor; a memorythat stores computer program instructions, the computer programinstructions executable by the hardware processor to cause the hardwareprocessor to: reconstruct a waveform of a target device from an inputwaveform using a target autoencoder; reconstruct a waveform of unrelatedsound events from the input waveform using an environmental autoencoder;classify the input waveform to determine that the input waveform isproduced by anomalous behavior of the target device using a classifier,based on the reconstructed waveform of the target device and thereconstructed waveform of the unrelated sound events; and generate anautomatic response to the anomalous behavior.
 14. The system of claim13, wherein the computer program instructions are further executable bythe hardware processor to cause the hardware processor to concatenate anoutput waveform of the target autoencoder current, an output waveform ofthe first autoencoder, and the input waveform.
 15. The system of claim14, wherein the classifier classifies the concatenated waveforms. 16.The system of claim 13, further comprising a sensor that generates theinput waveform in an environment that includes the target device. 17.The system of claim 13, wherein the first environmental autoencoder istrained using sample waveforms of multiple different sounds, unrelatedto operation of the target device.
 18. The system of claim 13, whereinthe computer program instructions are further executable by the hardwareprocessor to cause the hardware processor to reconstruct waveforms ofunrelated sound events using an additional environmental autoencoder.19. The system of claim 18, wherein the computer program instructionsare further executable by the hardware processor to cause the hardwareprocessor to combine a subset of the input waveform, a reconstructedwaveform output of the target autoencoder, and reconstructed waveformoutputs of the first environmental autoencoder and the at least oneadditional environmental autoencoder.
 20. The system of claim 13,wherein the computer program instructions are further executable by thehardware processor to cause the hardware processor to perform an actionselected from the group consisting of changing settings on the targetdevice, changing qualities of the environment, and turning off thetarget device or other nearby equipment.